3 ms·

Since it's show 'n tell, you can't get a .bank without a bank charter. https, dnssec, tls > 1.2, and dmarc are all mandatory and the registrar does scan everyth

• tptacek 5y ago
  That's all pretty performative given that the largest and most important banking sites on the Internet (1) aren't on .bank and (2) don't use DNSSEC; that this is the case despite those banks operating some of the largest and best-resourced security teams in the industry should tell us something.
  • jabroni_salad 5y ago
    As someone who started their career at an F100 and now consults in the SMB space, all it really tells me is that the change is not worth pushing through the bureaucracy and bringing a new mandatory thing to millions of consumers. At a small town bank, whose risk tolerance is maybe one major loss event per decade? Where a given complaint is never more than 3 people removed from the CEO? Who'se antifraud resources are just normal bankers that also have some extra tasks assigned to them? Being able to get homoglyph attacks off the risk board at the cost of a few of my billable hours and a week of effort from the marketing person is a no-brainer to them.
    • tptacek 5y ago
      I mean, small town banks, sure. And also: > $ host -t ds bankofamerica.com bankofamerica.com has no DS record